KR20220032788A - Method And System for Providing Cyber Attack Simulation - Google Patents

Abstract

Disclosed are a cyber attack simulation providing method and a system thereof. The present embodiment provides the cyber attack simulation providing method and the system thereof which identify an attack exposure surface, which needs to be managed for use to repeatedly check a security policy and a security state which are in operation in an organization, in advance, thereby enabling continuous security evaluation and effective security enhancement.

Description

Method And System for Providing Cyber Attack Simulation

One embodiment of the present invention relates to a method and system for providing a cyber attack simulation.

The content described below merely provides background information related to the present embodiment and does not constitute the prior art.

Recently, data breaches and industrial technology leaks due to hacking are constantly occurring. Over the past five years, hacking and data breaches have occurred continuously in the fields of finance, manufacturing, hotel, public, distribution, IT, defense, and security. According to a recent report by IBM and Ponemon Research Institute, domestic companies suffered an average of about 3.1 billion won in financial damage due to data breaches. According to a survey on technology protection of SMEs conducted by the Industrial Technology Protection Association, the damage amount of industrial technology leakage by SMEs in the past three years totaled 302.1 billion won.

According to Cybersecurity Ventures' annual report on cybercrime, the global economic damage caused by cyberattacks is expected to reach $6 trillion by 2021, and it is counted as the total cost of tangible and intangible damage that can occur from cyberattacks.

As the number of hacks increases and the damage becomes more serious, the security technology is rapidly developing, but in order to respond to a cyber attack, it is being advanced only in the area of defense technologies to detect and block it at the time an attack is in progress.

Breach and Attack Simulation (BAS) technology put BAS technology in the innovation trigger stage in the hype cycle of 'Threat-Facing Technologies' in 2017, and the productivity stabilization stage (Plateau) within the next 5-10 years. ) was predicted to be reached. Accordingly, leading companies in the field are currently developing solutions and building the market.

According to a recent survey conducted at the RSA conference, many security professionals are currently using security devices and services, but are not sure whether these devices are actually working as intended or taking advantage of the features of the security products they purchase. In addition, the security equipment is too complex and difficult to set up. Therefore, it requires attack simulation technology from a social point of view.

Continuous and consistent testing of security posture is required. Recently, the importance of an approach that strengthens the security of the overall IT environment by identifying the attack surface through repeated security evaluation and establishing a response strategy is being emphasized. Therefore, it requires attack simulation technology from a technical point of view.

This embodiment provides a method of providing a cyber attack simulation that enables continuous security evaluation and effective security reinforcement by identifying in advance the attack surface that needs to be managed so that it can be used to repeatedly check the security policy and status in operation in the organization; The purpose is to provide a system.

According to an aspect of this embodiment, a pre-infiltration information collection process of selecting an attack target in the Internet network based on a control command received from an attacker terminal, and collecting internal information about the attack target; an initial penetration process of identifying an accessible path based on the inside information; a process of securing a base to execute the agent installed in the attack target; When it is confirmed that it is possible to connect with the agent, an authority elevation process of confirming an elevation of authority to access the attack target; After transmitting the attack command to the agent, when the attack target installed with the agent is ineffective according to the attack command, a main information collection command is transmitted to the agent, and the main information corresponding to the main information collection command from the agent an internal reconnaissance process to collect; And it provides a cyber attack simulation providing method comprising the steps of: stealing the main information to the outside and removing traces of the important information theft by using the agent.

As described above, according to this embodiment, by identifying in advance the attack surface that needs to be managed so that it can be used to repeatedly check the security policies and statuses being operated by the organization, continuous security evaluation and effective security can be strengthened. has the effect of

1 is a diagram illustrating a cyber attack simulation providing system according to the present embodiment.
2 is a flowchart illustrating a method for providing a cyber attack simulation according to the present embodiment.
3 is a diagram for explaining the definition of a cyber attack simulation function according to the present embodiment.
4 is a view for explaining the steps of collecting information and performing reconnaissance before infiltration according to the present embodiment.
5 is a view for explaining the first penetration step according to the present embodiment.
6 is a view for explaining the step of securing a base according to the present embodiment.
7 is a view for explaining an authority elevation step according to the present embodiment.
8 is a view for explaining the internal reconnaissance step according to the present embodiment.
9A and 9B are diagrams for explaining the step of achieving an object according to the present embodiment.

Hereinafter, this embodiment will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a cyber attack simulation providing system according to the present embodiment.

The cyber attack simulation providing system can identify the most vulnerable point of the attack target based on the data that performs Offensive Security (mock hacking, APT test) in the empirical aspect, and includes various attack scenarios. The cyber attack simulation providing system performs an attack according to preset steps (eg, a total of 6 steps) in terms of technology.

The cyber attack simulation providing system collects the company information that is actually exposed and uses the collected information to construct a scenario of infiltration from the outside to the inside. The cyber attack simulation providing system configures a simulator that can automatically perform detailed attack techniques by linking the flow of a step-by-step attack with Miter Attack after internal penetration.

The cyber attack simulation providing system can expand and apply new types of attack technologies and scenarios based on plug-in scenarios. In terms of operation, the cyber attack simulation providing system can continuously reflect techniques/techniques, new vulnerabilities, and variant malicious codes according to new hacking scenarios. The cyber attack simulation providing system provides, for example, a six-step attack test simulator (Attack Simulator).

The cyber attack simulation providing system performs pre-infiltration information collection/reconnaissance in the first stage. The cyber attack simulation providing system is the first step in collecting external information (DNS, Sub-Domain, open ports and services, etc.), collecting web server information (system type, version, CMS, development language, etc.), opening and deep web (Deep Web) Collects information (important files, sensitive information-e-mail, phone number, etc.).

The cyber attack simulation providing system provides the first penetration simulator in two stages. The cyber attack simulation providing system sends and confirms malicious code attachments (spear phishing)/malicious link (watering hole) mail in two steps, attacks on identified infrastructure (WEB, WAS, CMS, etc.) information/service vulnerabilities, server penetration without firewall Perform attacks (shellshock, RDP, FTP, SSH).

The cyber attack simulation providing system provides a base securing simulator in three steps. The cyber attack simulation providing system performs three steps: securing a PC and server base, executing a specified command during a reverse connection with the attack server, and collecting key-logging information.

The cyber attack simulation providing system provides a privilege escalation simulator in four steps. The cyber attack simulation providing system performs a brute-force attack after collecting information for Linux environment privilege elevation, Windows environment privilege elevation, and system privilege elevation in four steps.

The cyber attack simulation providing system provides the internal reconnaissance simulator in five steps. The cyber attack simulation providing system performs the function of securing an internal server base and repeating reconnaissance in five steps.

The cyber attack simulation providing system provides the goal achievement simulator in six steps. The cyber attack simulation providing system performs the function of inserting malicious code for testing in 6 steps, compressing and transmitting important files for testing, and automatically deleting logs for hiding/avoidance.

The cyber attack simulation providing system according to the present embodiment includes an attacker terminal 110 , an attack server 120 , and an agent 130 . Components included in the cyber attack simulation providing system are not necessarily limited thereto.

The attacker terminal 110 transmits attack target information to the attack server 120 . The attacker terminal 110 transmits an internal information collection command for the attack target to the attack server 120 . The attacker terminal 110 transmits an attack command to the attack target to the attack server 120 .

The attacker terminal 110 transmits an agent installation and distribution command for the attack target to the attack server 120 . The attacker terminal 110 transmits an attack command to the attack server 120 . The attacker terminal 110 transmits a main information collection command for the attack target to the attack server 120 . The attacker terminal 110 transmits a command to remove the trace of the stealing to the attack server 120 .

The attack server 120 collects information from an external network and identifies a service. The attack server 120 performs an attack and initial penetration as an attack target characterized by an attack target among information collected from an external network. After the attack server 120 penetrates into an attack target, a connection for securing a base and installation of the agent 130 are performed.

The attack server 120 performs an attack for privilege elevation after installing a reverse connection and agent 1 (A1) as an attack target. The attack server 120 transmits an attack command to agent 1 (A1) as an attack target, and then performs a continuous spread (transfer) attack to agent 2 (A2) through internal reconnaissance. The attack server 120 transmits an attack command to the agent 1 (A1) and agent 2 (A2) as an attack target, and then performs the purpose (such as stealing important information and removing traces).

The attack server 120 performs a pre-infiltration information collection process, an initial infiltration process, a base securing process, an authority elevation process, an internal reconnaissance process, and an objective achievement process.

The attack server 120 selects an attack target from the external network based on the control command received from the attacker terminal 110 and performs a pre-infiltration information collection process of collecting internal information about the attack target.

The attack server 120 collects information disclosed to the outside based on OSINT (Open Source Intelligence), crawling, and dark web for an attack target in an external network to perform a pre-penetration information collection process. collected with The attack server 120 collects information scanned for an attack target from an external network as internal information in order to perform a pre-infiltration information collection process.

The attack server 120 collects service identification information, search engine information, and sub-domain information for the attack target as internal information after selecting an attack target from an external network to perform a pre-infiltration information collection process.

The attack server 120 performs an initial penetration process of identifying an accessible path based on internal information collected from an attack target.

The attack server 120 identifies the vulnerability of the attack target based on internal information collected from the attack target in order to perform the first penetration process. When it is confirmed that the attack target can be accessed based on the vulnerability, the attack server 120 performs an exploit attack on the vulnerability. If it is confirmed that the attack server 120 cannot access the attack target based on the vulnerability, the attack server 120 approaches the first security bypass attack target. When it is confirmed that the attack server 120 cannot access the first security bypass attack target, the attack server 120 approaches the attack target through a general path. When it is confirmed that the attack target cannot be accessed through the general path, the attack server 120 performs a malicious code attack through other paths.

The attack server 120 performs a brute-force attack on the attack target to perform the first penetration process, checks the default page on which file upload is performed, or performs SQL injection (SQL Injection) is performed, and the vulnerability of the attack target is identified by checking the SQL Error Page.

The attack server 120 performs a process of securing a base to execute the agent installed on the attack target.

In order to perform the process of securing a base, the attack server 120 succeeds in an exploit attack on a vulnerability, accesses the first security bypass attack target, approaches the attack target through a general path, or when a malicious code attack succeeds, It is checked whether it is possible to connect to the agent 130 installed in the attack target. If it is confirmed that the connection to the agent 130 is possible as a result of the check, the attack server 120 transmits an execution command to the agent 130 to execute the agent 130 . If it is confirmed that connection to the agent 130 is not possible as a result of the check, the attack server 120 transmits an execution command to the second security bypass agent 130 .

The attack server 120 performs an xp_cmdshell extension procedure, webshell creation or command execution, and server authorization check by performing SQL injection on the attack target in order to perform the process of securing a base. The attack server 120 transmits an execution command for executing the agent 130 to the attack target after the agent 130 is downloaded to the attack target based on the confirmed information. When the agent 130 is executed by the execution command, the attack server 120 performs a reverse connection with the agent 130 . Thereafter, the attack server 120 causes the agent 130 to perform a persistence function, and configures tunneling with the agent 130 .

When it is confirmed that the attack server 120 can connect with the agent 130 installed in the attack target, the attack server 120 performs a privilege elevation process for confirming the elevation of access to the attack target.

The attack server 120 transmits an attack command using the agent 130 installed in the attack target to perform the privilege elevation process, and then when the attack target installed with the agent 130 is neutralized according to the attack command, the attack target Check the elevation of access to .

The attack server 120 extracts pre-stored account information from a web source, a setting file, and a plain text file of an attack target on which the agent 130 is installed by using the agent 130 to perform a privilege elevation process. The attack server 120 uses the agent 130 to perform a local privilege elevation vulnerability attack based on Common Vulnerabilities and Exposures (CVE). The attack server 120 performs a brute force attack on the account that can be inferred by using the agent 130 as a brute-force attack. The attack server 120 collects account information by a key-logger using the agent 130 and then periodically monitors it. The attack server 120 neutralizes the attack target in which the agent 130 is installed by a local privilege elevation vulnerability attack or brute force attack.

The attack server 120 transmits an attack command to the agent 130 installed in the attack target, and then transmits a main information collection command to the agent 130 when the attack target installed with the agent 130 is neutralized according to the attack command. , an internal reconnaissance process of collecting main information corresponding to the main information collection command from the agent 130 is performed.

In order to perform the internal reconnaissance process, the attack server 120 performs an administrator (Admin) authority unit attack on the attack target when it is confirmed that access to the attack target is elevated. The attack server 120 performs an attack in units of user (User) authority when the elevation of access to the attack target is not confirmed. When the execution command is not transmitted to the second security bypass agent or a malicious code attack is possible through a general path, the attack server 120 performs a host-level unit attack based on the malicious code. The attack server 120 performs other attacks using a third-party program when it is impossible to scan an attack target, access to another path, or a normal path to attack a malicious code.

In order to perform the internal reconnaissance process, the attack server 120 returns to the agent 130 when the attack target in which the agent is installed is incapacitated due to the success of an administrator-privileged unit attack, a user-privileged unit attack, a host-level unit attack, and other attacks to perform the internal reconnaissance process. Sends a command to collect important information.

The attack server 120 transmits an attack command to the adjacent agent using the agent 130 to perform the internal reconnaissance process, and then, when the attack target installed with the adjacent agent is neutralized according to the attack command, to the agent and the adjacent agent. Sends a command to collect important information.

The attack server 120 collects important information (accounts, settings, confidential information, etc.) in the attack target (server or terminal) where the agent 130 is installed by using the agent 130 to perform the internal reconnaissance process. By scanning the external network, key information is collected from the agent 130 . The attack server 120 identifies the agent 130 and the adjacent agent based on the main information. The attack server 120 performs a transfer attack to an adjacent agent based on the main information. The attack server 120 causes an additional agent to be downloaded to the adjacent agent when the transfer attack to the adjacent agent is successful. Thereafter, the attack server 120 transmits an additional execution command for executing the additional agent to the attack target in which the adjacent agent is installed.

The attack server 120 seizes the main information to the outside and performs the purpose of achieving the purpose of removing traces of the stealing of the important information by using the agent 130 installed in the attack target.

The attack server 120 deletes a log for an attack target on which the agent 130 is installed after the agent 130 collects main information, creates a process, creates a backdoor, and a keylogger in order to perform the purpose achievement process. At least one of (Key-Logger), MBR (Master Boot Record) destruction, capture, and compression is performed.

The attack server 120 encrypts the main information collected from the agent 130 and the adjacent agent in order to perform the purpose achievement process, and then steals it to the outside using a secret channel or encrypted communication. The attack server 120 uses the agent 130 and an adjacent agent to remove login traces, remove event logs, remove modules used for attack, and perform agent self-deletion. The attack server 120 uses the agent 130 and an adjacent agent to capture and transmit the main information stealing screen and trace removal screen for the attack target. The attack server 120 deletes the captured file for trace removal.

The attack server 120 attacks an attack target based on a plurality of scenarios (eg, scenarios 1 to 5) according to an attack command received from the attacker terminal 110 .

The attack server 120 attacks an attack target in Scenario 1.

① The attack server 120 infects a malicious code of a file (eg, Hwp) with a specific extension using an attack target's USB, mail, or the like. ② The attack server 120 creates an additional process when the malicious code is executed on the attack target. ③ The attack server 120 performs additional host infection and transfer attack based on the attack target. ④ The attack server 120 collects user information from the attack target by using key-logging. ⑤ The attack server 120 performs all actions that the agent 130 installed on the attack target can perform. ⑥ The attack server 120 removes traces from the attack target and leaks it to the outside.

The attack server 120 attacks an attack target in scenario 2 .

① The attack server 120 infects a third-party (3rd-P) keyboard security solution with malicious code. ② The attack server 120 causes the keyboard security solution to be down to the attack target by using an Internet link. ③ The attack server 120 infects a host to be attacked with malicious code. ④ The attack server 120 performs additional host infection and transfer attack. ⑤ The attack server 120 checks the system information and network (NIC: Network Interface Controller) information of the attack target. ⑥ The attack server 120 executes file upload and download in the server to be attacked. ⑦ The attack server 120 removes the trace of the attack target and leaks it to the outside.

The attack server 120 attacks an attack target in scenario 3 .

① The attack server 120 infects a malicious code inside an attack target by using the scenario 1 or scenario 2. ② The attack server 120 acquires AV (Anti-Virus) information from a host that is an attack target. ③ The attack server 120 attacks the unpatched AV (Vi-robot) specific version of the target host based on the AV information. ④ The attack server 120 executes an additional process on the attack target host. ⑤ The attack server 120 acquires user information and important information from a host that is an attack target. ⑥ The attack server 120 removes the trace of the attack target and leaks it to the outside.

The attack server 120 attacks an attack target in Scenario 4.

① The attack server 120 infects a malicious code inside an attack target by using the scenario 1 or scenario 2. ② The attack server 120 acquires AV (Anti-Virus) information from a host that is an attack target. ③ The attack server 120 attacks the unpatched AV (Vi-robot) specific version of the target host based on the AV information. ④ The attack server 120 executes an additional process on the attack target host. ⑤ The attack server 120 bypasses the firewall of the host by using network tunneling. ⑥ The attack server 120 acquires user information and important information from a host that is an attack target. ⑦ The attack server 120 removes the trace of the attack target and leaks it to the outside.

The attack server 120 attacks an attack target in scenario 5.

① The attack server 120 infects a malicious code inside an attack target by using the scenario 1 or scenario 2. ② The attack server 120 checks the internal network (NIC: Network Interface Controller) information of the target host. ③ The attack server 120 additionally infects the network separation terminal with malicious code and performs remote control. ④ The attack server 120 uploads a malicious file in the management page of the internal network AV server. ⑤ The attack server 120 removes the trace of the attack target and leaks it to the outside.

The agent 130 is installed in the form of being downloaded to the attack target (server or terminal) and is connected to the attack server 120 through a reverse connection. The agent 130 neutralizes the attack target by performing an attack on the target (server or terminal), and when the target is neutralized, it collects main information on the target and transmits it to the attack server 120 .

2 is a flowchart illustrating a method for providing a cyber attack simulation according to the present embodiment.

The attacker terminal 110 transmits a control command for selecting an attack target to the attack server 120 . The attacker terminal 110 transmits a control command for service identification, search engine, and information collection for the subdomain to the attack server 120 .

The attack server 120 receives a control command for target setting or information collection from the attacker terminal 110 . The attack server 120 selects an attack target from the external network and then checks whether information disclosed to the outside (OSINT (Open Source Intelligence), Crawling, Dark Web, etc.) is collected (S210) ).

As a result of checking in step S210, when the information disclosed to the outside is not collected, the attack server 120 checks whether or not internal information is collected (internal scan) (S212).

As a result of the confirmation of step S210, when the externally disclosed information is collected, or as a result of the confirmation of step S212, when internal information is collected (internal scan), the attack server 120 accesses the attack target based on vulnerability (Web, App) It is checked whether this is possible (S214).

As a result of checking in step S214, if the vulnerability (Web, App)-based access to the attack target is not possible, the attack server 120 checks whether access to the general path as the attack target is possible (S216).

As a result of the check in step S216, if it is impossible to access the general path as the attack target, the attack server 120 checks whether access to the other path as the attack target is possible (S218).

As a result of checking in step S214, if a vulnerability (Web, App)-based access to the attack target is possible, the attack server 120 checks whether an exploit attack for the vulnerability is possible (S220).

As a result of the verification of step S220, if an exploit attack for the vulnerability is not possible or as a result of the verification of step S214, if the vulnerability (Web, App)-based access to the target is not possible, the attack server 120 provides security for the target. It is checked whether the detour is possible (S222).

As a result of the check in step S218, if the attack target can be accessed through other paths, the attack server 120 checks whether malicious code can be distributed through other paths (S224).

If, as a result of the verification of step S220, an exploit attack on the vulnerability is possible, or as a result of the verification of step S222, a security bypass to the target is possible, or as a result of the verification of step S216, if the general path is accessible as an attack target, the attack The server 120 checks whether it is possible to connect to the agent 130 installed in the attack target (S226).

As a result of checking in step S226, if the connection to the agent 130 installed in the attack target is not possible, the attack server 120 checks whether a security bypass for the attack target is possible (S228).

As a result of the check in step S226, if it is possible to connect to the agent 130 installed in the attack target, the attack server 120 checks whether it is possible to elevate the authority to the attack target (S230).

As a result of the check in step S230, if it is possible to raise the authority to the attack target, the attack server 120 performs an Admin authority unit attack (S232). As a result of the check in step S230, if it is impossible to raise the authority to the attack target, the attack server 120 performs a user authority unit attack (S234).

As a result of the verification in step S228, if the security bypass to the attack target is impossible or as a result of checking in step S224, malicious code distribution is possible through other routes, the attack server 120 performs a unit attack on the host level based on the malicious code (S236) .

If, as a result of checking in step S224, it is impossible to distribute the malicious code through other routes, or if, as a result of checking in step S218, access to other routes as an attack target is not possible, or as a result of checking in step S212, internal information is not collected (internal scan), the attack server 120 performs another attack using a third party (3rd-p) (S238).

After performing steps S232, S234, S236, and S238, the attack server 120 requests the agent 130 installed in the attack target to collect internal information and reconnaissance (S240). The attack server 120 collects internal information from the agent 130 installed in the attack target and reconnaissance information (log deletion, process creation, backdoor, key-logger, MBR (Master Boot Record) destruction, capture/compression/transmission) is received (S242).

Although it is described that steps S210 to S242 are sequentially executed in FIG. 2 , the present invention is not limited thereto. In other words, since it may be applicable by changing and executing the steps described in FIG. 2 or executing one or more steps in parallel, FIG. 2 is not limited to a time-series order.

As described above, the cyber attack simulation providing method according to the present embodiment described in FIG. 2 may be implemented as a program and recorded in a computer-readable recording medium. A computer-readable recording medium in which a program for implementing the method for providing a cyber attack simulation according to the present embodiment is recorded includes all types of recording devices in which data readable by a computer system is stored.

3 is a diagram for explaining the definition of a cyber attack simulation function according to the present embodiment.

The attacker terminal 110 is connected to the attack server 120 to transmit a control command. The attack server 120 selects an attack target based on the control command, and installs the agent 130 in the attack target. The attack server 120 performs an attack on the attack target based on the agent 130 .

The attacker terminal 110 is loaded with a program that the attacker executes for the purpose of commanding and controlling the entire situation. The attacker terminal 110 synchronizes the sync while continuously communicating with the attack server 120 . The attacker terminal 110 checks the overall attack status (Dash Board role) in a GUI environment. The attacker terminal 110 selects the icon of the server in which the agent 130 is installed and then requests a command and information inquiry.

The attack server 120 works with the AI framework. The attack server 120 receives and executes a command for an attack action from the attacker terminal 110 . The attack server 120 is composed of various modules (Stand Alone) required for the attack. The attack server 120 stores logs for all action events (attack server 120/agent 130). The attack server 120 creates and distributes the agent 130 to be installed after successful attack (authorization acquisition). The attack server 120 supports tunneling servers such as VPN, Socks, and SSH. The attack server 120 includes a main frame (encrypted communication) that communicates with the attacker terminal 110 .

The attack server 120 includes a first attack module (Stage1) required to install the agent 130 for the first time. The attack server 120 attempts to collect information and first attack by using the first attack module Stage1. The attack server 120 collects information using port scan, Brute force, Google hacking, and the like. The attack server 120 performs an initial attack on WEB, FTP, SSH, SMB, TELNET, RDP, VNC, and the like.

The attack server 120 includes a second attack module Stage2 that can be performed using the installed agent 130 . The attack server 120 performs an attack and pivoting-related (Post Exploitation) operation with the first attack module Stage1 by using the second attack module Stage2.

The attack server 120 includes a manager for adding or modifying a first attack module (Stage1) and a second attack module (Stage2).

The attack server 120 includes an agent 130 that is installed after a successful attack on the target. The attack server 120 creates and modifies binaries (Windows PE Executable, Windows DLL, Linux Binary, Linux Shared Object, Python Script, etc.) that are executed according to the Windows/Linux environment for the agent 130 .

The attack server 120 performs log-based reporting. The attack server 120 generates a timeline-based report on a specific host attack result. The attack server 120 provides the flow (attack tree) of the performed or selected attack as a report.

The agent 130 includes a client that communicates with the attack server 120 (encrypted communication). The agent 130 includes binaries (Windows, Linux) that are installed on a server (HOST) or a terminal (PC) when authority is obtained through an attack. The agent 130 serves as a command interpreter performing an attack of the attack server 120 . The agent 130 supports various network pivoting functions and self-deleting functions.

The agent 130 is installed in a server (HOST) or a terminal (PC) that is an attack target to collect system information. The agent 130 supports a basic system information confirmation function, and collects system basic information (host name, IP, user name, operating system information, system specifications, authority, etc.).

The agent 130 is installed in a server (HOST) or a terminal (PC), which is an attack target, and checks the currently running process and installed program. The agent 130 is installed on a server (HOST) or a terminal (PC), which is an attack target, checks programs/processes installed in Linux/Windows, checks third-party program vulnerabilities, and checks information on vaccines.

The agent 130 is installed on a server (HOST) or a terminal (PC), which is an attack target, and checks the currently running service, and checks the window service. The agent 130 is installed in a server (HOST) or a terminal (PC), which is an attack target, to check network (NIC) information, and to check a network band. The agent 130 is installed in a server (HOST) or a terminal (PC), which is an attack target, and performs a tile explorer. The agent 130 searches for a file in the server using the file search menu of the file explorer, and uploads, downloads, executes, modifies, and creates the file.

The agent 130 is installed in a server (HOST) or a terminal (PC), which is an attack target, and performs a screen capture. The agent 130 captures the screen of the current logon state using the screen capture function or collects information through the screen capture (eg, account information recorded on the desktop sticker note, etc.).

The agent 130 is installed in a server (HOST) or a terminal (PC) that is an attack target and performs key-logging. The agent 130 stores key input contents locally using a key-logging function or collects information using key-logging.

The agent 130 is installed in a server (HOST) or a terminal (PC) that is an attack target to perform remote control. The agent 130 performs remote control in a manner similar to Virtual Network Computing (VNC) using a remote control function. The agent 130 uses a remote control function to capture a real-time screen or use a mouse pointer coordinate value after a screen capture.

The agent 130 is installed on a server (HOST) or a terminal (PC) that is an attack target to support a shell function. The agent 130 executes a shell command command using a shell function or uses a Windows/Linux basic shell command.

The agent 130 is installed in a server (HOST) or a terminal (PC) that is an attack target and performs a network relay function. The agent 130 performs tunneling using a network relay function, and supports port forwarding, Socks, SSH, VPN, and HTTP.

The agent 130 is installed on the server (HOST) or terminal (PC) that is the target of the attack, obtains account information (password) registered in the server, or collects a user name, and collects password/hash using Mimikatz, Wce, etc. do.

The agent 130 is installed on a server (HOST) or a terminal (PC), which is an attack target, and collects browser passwords, stored Wi-Fi passwords, and Outlook account information for transfer attack.

The agent 130 is installed in a server (HOST) or a terminal (PC) that is an attack target, and collects information using a registry explorer. The agent 130 checks network/account information registered in the registry.

4 is a view for explaining the steps of collecting information and performing reconnaissance before infiltration according to the present embodiment.

The attacker terminal 110 transmits attack target information to the attack server 120 . The attack server 120 collects information from an external network and identifies a service.

The attacker terminal 110 transmits a control command for setting an attack target (eg, *.a.com) to the attack server 120 . The attacker terminal 110 transmits a control command for service identification, search engine, and information collection for the subdomain to the attack server 120 .

The attack server 120 receives a control command for target setting or information collection from the attacker terminal 110 . The attack server 120 selects the attack target (*.a.com) from the external network and collects service identification (21 FTP, 22 SSH, 80 web, 445 SMB, 3389 RDP, 3306 MYSQL, 8080 TOMCAT, etc.) information do. The attack server 120 collects search engine (ADMIN Page, SQL Error, Test Page, Default Page (CMS Editor), etc.) information for the attack target (*.a.com) selected from the external network. The attack server 120 collects sub-domain (dev, test, Intra, etc.) information about the attack target (*.a.com) selected from the external network.

5 is a view for explaining the first penetration step according to the present embodiment.

The attacker terminal 110 transmits an attack command to the attack server 120 . The attack server 120 performs an attack and initial penetration as an attack target characterized by an attack target among information collected from an external network.

The attacker terminal 110 transmits a control command for setting an attack target (eg, a.com, dev.a.com) to the attack server 120 . The attacker terminal 110 transmits a control command for attacking an attack target (Brute-Force, File Upload, SQL Injection, CVE Attack) to the attack server 120 .

The attack server 120 performs an attack (21 FTP, 22 SSH, 8080 TOMCAT) against [a.com], which is the target of a brute force attack (Brute-Force), and for [dev.a.com] as the target of attack Attack (80 WEB).

The attack server 120 checks the default page (CMS Editor) for the attack target [a.com] by file upload. The attack server 120 checks the SQL Error Page for the attack target [a.com] by SQL injection. The attack server 120 performs an attack (TOMCAT) on [dev.a.com], an attack target as a CVE attack.

6 is a view for explaining the step of securing a base according to the present embodiment.

The attacker terminal 110 transmits an attack command to the attack server 120 . After the attack server 120 penetrates into the attack target, a connection for securing a base and installation of the agent 130 are performed.

The attacker terminal 110 transmits a control command for setting an attack target (eg, dev.a.com) to the attack server 120 . The attacker terminal 110 transmits a control command for attacking an attack target (SQL Injection (extended procedure)) to the attack server 120 . The attacker terminal 110 transmits to the attack server 120 a control command to distribute the Win binary and the executing agent 130 as an attack target.

The attack server 120 performs SQL Injection on the attack target [dev.a.com], and proceeds with the xp_cmdshell extension procedure, web shell creation or command execution, server permission check, and agent 130 installation. The agent 130 installed in the attack target is downloaded from the attack server 120 to the attack target, and the agent is executed and a reverse connection is performed. The agent 130 performs a persistence function and configures tunneling with the attack server 120 .

7 is a view for explaining an authority elevation step according to the present embodiment.

The attacker terminal 110 transmits an attack command to the attack server 120 . The attack server 120 performs an attack for privilege elevation after installing the Reverse Connection and the agent 130 (A1) as an attack target.

The attacker terminal 110 transmits a control command for setting an attack target (eg, agent 1 (A1)) to the attack server 120 . The attacker terminal 110 transmits a control command to the attack server 120 to elevate authority to the attack target (collect information in the server, brute-force attack, and key-logger execution) to the attack server 120 . .

The attack server 120 collects information from the agent 1 (A1) installed in the attack target.

Agent 1 (A1) verifies the account of the installed attack target by using a command to collect information. Agent 1 (A1) searches for account information stored in web sources, various setting files, and plain text files. Agent 1 (A1) performs a local privilege escalation vulnerability attack (CVE).

Agent 1 (A1) performs a brute force attack on an account that is easy to infer for a brute-force attack. Agent 1 (A1) collects account information by a key-logger and monitors it periodically.

8 is a view for explaining the internal reconnaissance step according to the present embodiment.

The attacker terminal 110 transmits an attack command to the attack server 120 . The attack server 120 transmits an attack command to agent 1 (A1) as an attack target, and then performs a continuous spread (transfer) attack to agent 2 (A2) through internal reconnaissance.

The attacker terminal 110 transmits a control command for setting an attack target (eg, agent 1 (A1)) to the attack server 120 . The attacker terminal 110 transmits a control command to the attack server 120 for internal reconnaissance (collection/absorption of important information, preparation for a transfer attack) of the attack target (agent 1 (A1)). The attacker terminal 110 transmits a control command to the attack server 120 to collect information (internal network reconnaissance, service identification) on the attack target (agent 1 (A1)).

The attack server 120 collects internal information from the agent 1 (A1), which is an attack target.

Agent 1 searches for important information (account, settings, confidential information, etc.) in the installed attack target (server or terminal) to collect internal information. Agent 1 (A1) scans the internal network network.

The attack server 120 performs a spread (transfer attack) to the agent 1 (A1), which is an attack target. Agent 1 (A1) performs continuous spread (transfer attack) through internal information obtained for spread (transfer attack). Agent 1 (A1) installs an additional agent upon successful attack.

9A and 9B are diagrams for explaining the step of achieving an object according to the present embodiment.

The attacker terminal 110 transmits an attack command to the attack server 120 . The attack server 120 transmits an attack command to the agent 1 (A1) and agent 2 (A2) as an attack target, and then performs the purpose (such as stealing important information and removing traces).

The attacker terminal 110 transmits a control command for setting an attack target (agent 1 (A1), agent 2 (A2)) to the attack server 120 . The attacker terminal 110 transmits a control command to the attack server 120 to steal important information about the attack target and remove traces.

The attack server 120 steals important information from the agent 1 (A1) and agent 2 (A2), which are the target of the attack. Agents 1 (A1) and 2 (A2) encrypt important data files of each attack target (server or terminal) installed to steal important information. Agents 1 (A1) and 2 (A2) leak important data files to the outside by using a hidden channel or encrypted communication.

The attack server 120 removes traces from agent 1 (A1) and agent 2 (A2), which are attack targets. Agent 1 (A1) and Agent 2 (A2) perform log-in trace removal of each attack target (server or terminal), event log removal, module used for attack removal, and agent self-deletion to remove traces.

As shown in Figure 9b, the agent 130 performs a screen capture after infiltrating the installed attack target (server or terminal).

The attacker terminal 110 transmits a control command for setting an attack target (agent 1 (A1), agent 2 (A2)) to the attack server 120 . The attacker terminal 110 transmits a control command for capturing a screen of the attack target to the attack server 120 .

The attack server 120 transmits a control command to the agent 130 to capture the screen (PNG format, 100% magnification) for stealing main information and removing traces. The agent 130 (A1, A2) transmits the captured file to the attack server 120 as a result of the execution. After that, the agent 130 (A1, A2) deletes the transmitted file for trace removal.

The above description is merely illustrative of the technical idea of this embodiment, and various modifications and variations will be possible without departing from the essential characteristics of the present embodiment by those skilled in the art to which this embodiment belongs. Accordingly, the present embodiments are intended to explain rather than limit the technical spirit of the present embodiment, and the scope of the technical spirit of the present embodiment is not limited by these embodiments. The protection scope of this embodiment should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present embodiment.

110: attacker terminal
120: attack server
130: agent

Claims (7)

a pre-infiltration information collection process of selecting an attack target from an external network based on a control command received from the attacker terminal and collecting internal information about the attack target;
an initial penetration process of identifying an accessible path based on the inside information;
a process of securing a base to execute the agent installed in the attack target;
When it is confirmed that the connection with the agent is possible, an authority elevation process of confirming the elevation of the authority to access the attack target;
After transmitting the attack command to the agent, when the attack target installed with the agent is ineffective according to the attack command, a main information collection command is transmitted to the agent, and the main information corresponding to the main information collection command from the agent an internal reconnaissance process to collect; and
The process of achieving the purpose of stealing the main information to the outside and removing the traces of the stealing of the important information by using the agent
Cyber attack simulation providing method comprising a. According to claim 1,
The pre-infiltration information collection process is
a process of collecting externally disclosed information as the internal information based on OSINT (Open Source Intelligence), crawling, and dark web for the attack target in the external network; and
The process of collecting information scanned on the attack target from the external network as the internal information
Cyber attack simulation providing method comprising a. 3. The method of claim 2,
The first penetration process is
identifying a vulnerability for the attack target based on the internal information, and performing an exploit attack on the vulnerability when it is confirmed that the attack target can be accessed based on the vulnerability;
if it is confirmed that access to the target is not possible based on the vulnerability, accessing the target by a first security bypass;
If it is confirmed that access to the attack target by the first security bypass is impossible, accessing the attack target through a general path; and
performing a malicious code attack through another path when it is confirmed that the attack target cannot be accessed through the general path;
Cyber attack simulation providing method comprising a. 4. The method of claim 3,
The process of securing the base
If the exploit attack for the vulnerability succeeds, the first security bypass approaches the attack target, the general path approaches the attack target, or the malicious code attack succeeds, whether it is possible to connect to the agent installed in the attack target sending the execution command to the agent when it is confirmed that the connection to the agent is possible as a result of the check; and
transmitting the execution command to the agent by a second security bypass when it is confirmed that connection to the agent is impossible;
Cyber attack simulation providing method comprising a. 5. The method of claim 4,
The internal reconnaissance process is
When it is confirmed that the access to the attack target is elevated, performing an Admin permission unit attack on the attack target;
If the elevation of access to the attack target is not confirmed, the process of performing a user permission unit attack;
performing a host-level unit attack based on malicious code when the execution command is not transmitted to the agent by the second security bypass or a malicious code attack is possible through the general path;
performing another attack using a third-party program when scanning is not possible for the attack target, access is not possible through the other path, or a malicious code attack is not possible through the general path;
Cyber attack simulation providing method comprising a. 6. The method of claim 5,
The internal reconnaissance process is
When the attack target in which the agent is installed is incapacitated due to the success of the manager-rights unit attack, the user-privileged unit attack, the host level unit attack, and the other attacks, a command to collect key information is transmitted to the agent How to provide cyberattack simulation. 7. The method of claim 6,
The process of achieving the above purpose is
After the agent collects the main information, deletes logs, creates processes, destroys backdoors, key-loggers, and MBR (Master Boot Record) for the attack target installed with the agent, captures, compresses Cyber attack simulation providing method, characterized in that to perform at least one or more of.

Images